Digital Risk in the Economy

Cambridge Centre for Risk Studies Advisory Board Research Showcase – 29 January 2019

Dr. Andrew Coburn Chief Scientist Cambridge Centre for Risk Studies A Lengthy History of Cyber Risk Research

2013 2014 2015 2016 2017 2018 Cyber Catastrophe Sybil Logic Bomb Business Blackout Exposure Data Schema Cyber Risk Cyber Risk Threat Monograph Stress Test CNI Scenario and Accumulation Risk Landscape Monitoring Outlook Scenario

2018 2018 2018 2018 2018 2018 Threat Actors in the Assessing Limits to Insights from the Assessing the Impact Cloud Outage: The Probabilistic Cyber Black Capabilities of rDDoS MISP Database of Global ISP Outages Potential for Cyber Assessment Economy Cyber Attacks Catastrophic Loss

2 Our New Publication

SOLVING CYBER RISK PROTECTING YOUR COMPANY AND SOCIETY

3 Working With Many of the World’s Leading Cyber Insurance Players

AIG Others

Chubb AXA XL

Zurich AXIS Beazley Travelers

4 Cyber Loss: A Modern Plague  1,000 companies a year report a theft of protected data  A data theft of 10 million records can cost a company a billion dollars  Over 3 billion personal data records have been stolen in US – Enough for each citizen to have lost their personal details 10 times  Companies suffer attempted denial of service attacks every 8 minutes  One in every 100 e-mails is suspected to carry malware  Online financial theft is estimated at tens of billions of dollars a year  Less than a hundred people were sent to jail for cyber crime in 2017

 We estimate that cyber loss runs at over $500,000,000,000 a year – Around 2% of Global GDP

5 The Potential for a Cyber Catastrophe

Cyber catastrophe e.g. Mega DDoS Cyber catastrophe e.g. Mass Data Exfiltration Cyber catastrophe e.g. Major Cloud Outage 1 in 10 Cyber catastrophe e.g. Contagious Malware Cyber attack takes down Odds of power grid the event Cyber triggers financial crisis occurring 1 in 100 within a year Cyber losses cause tech aversion Cyber triggers 1 in 1,000 a major war

1 in 10,000 $1 $10 $100 $1 $10 $100 Billion Billion Billion Trillion Trillion Trillion

Economic loss if event occurred 6 Cyber Malaise

. We first identified the concept of economic loss through tech aversion in our 2013 Sybil Logic Bomb scenario . Sybil’s impact in causing distrust cost an estimated $5 to $15 Trillion to the global economy

IT Sector

7 The FAANGs

. Facebook, Apple, Amazon, Netflix, Alphabet’s Google Apple . Collective Market Capitalization is over $3 trillion Amazon . These five companies alone represent 11 percent of the S&P 500 index Google . They have a combined annual revenue of over $600 Bn Facebook . They have grown very rapidly Netflix . They represent the new digital economy 0 100 200 300 Annual Revenue 2018 $Billions

8 Mapping of US Companies by Size & Sector Premier Large Medium Small All % of total U.S. Number of Employees: >2,000 500-1,999 100-499 20-99 Revenue: >$3 Bn $40m-$3Bn $10m-$40m $2m-$20m Ave Annual Revenue: $14 Bn $240 m $28 m $11 m Business Sector Information Technology - Software 11 55 267 1,046 1,379 0.2% IT Sector Information Technology - Hardware 12 14 61 168 255 0.0% Premier 55 Information Technology - Services 32 395 1,897 7,507 9,831 1.6% Retail 177 2,177 12,645 80,486 95,485 16.0% Large 464 Financial Services - Banking 44 277 2,201 6,238 8,760 1.5% Total 519 Financial Services - Insurance 70 254 976 4,061 5,361 0.9% Financial Services - Investment Management 52 205 2,201 2,362 4,820 0.8% Healthcare 47 2,877 15,654 61,702 80,280 13.4% Companies whose Business & Professional Services 49 4,473 15,757 60,704 80,983 13.6% revenues are Energy 58 27 338 1,838 2,261 0.4% derived completely Telecommunications 13 43 221 1,013 1,290 0.2% Utilities 89 94 527 2,986 3,696 0.6% online: 277 Tourism & Hospitality 27 681 6,292 87,155 94,155 15.8% Manufacturing 285 2,119 8,805 40,876 52,085 8.7% Pharmaceuticals 23 34 136 354 547 0.1% Defense / Military Contractor 2 25 27 124 178 0.0% Entertainment & Media 37 407 2,528 15,385 18,357 3.1% Transportation / Aviation / Aerospace 43 896 2,937 13,985 17,861 3.0% Public Authority / NGOs / Non-Profit 0 215 1,558 18,562 20,335 3.4% Real Estate / Property / Construction 28 813 5,592 48,516 54,949 9.2% Education 16 387 2,398 13,372 16,173 2.7% Mining & Primary Industries 4 81 236 759 1,080 0.2% Food & Agriculture 56 283 1,210 5,295 6,844 1.1% Other 0 215 1,558 18,562 20,335 3.4% All 1,173 17,047 86,021 493,056 597,297 0.2% 2.9% 14.4% 82.5%

9 Profile of the Large IT Company Sector

IT Ranking of Companies by Revenue Software Hardware Services of 4,904 Enterprises reporting revenue Total Number of Companies in Sector 421 125 896 1 290 Number of Companies Reporting Revenue 286 80 596 579 868 % of Companies with Reported Revenue 68% 64% 67% 1157 Total Revenue of Companies Reporting ($m) 184,086 528,296 804,436 1446 1735 Average Revenue of Reported ($ millions) 644 6,604 1,350 2024 2313 2602 2891 Revenue of Largest Company in Sector ($m) 19,089 220,288 85,320 3180 Largest Company in Sector Schlumber Apple Inc. Microsoft Corp 3469 Technologies Inc. 3758 4047 Company ID 5215 452 3938 4336 4625 Median Revenue (50th %ile) of Sector ($m) 225 482 199 1 10 100 1,000 1 10,000Bn 10100,000 Bn 1001,000,000 Bn Example Company at 50th %ile with that HubSpot, Inc. Quantum Turning revenue Corporation Technologies, LLC Millions of $ Annual Revenue (Log Scale) Example Company ID 3021 4876 6248

No. of Companies with Web Address & IP info 305 74 644 % of Companies in Sector with Known Web Info 72% 59% 72% Monthly Visitors of Websites in Sector (billions) 3.1 3.2 216.0

10 ‘Internet Businesses’: Online Revenue Dependency 277 IT companies have revenues that are 90+% dependent on online Internet and Direct Marketing Retail (Sample) Internet and Direct Marketing Retail Newegg Inc. • Netflix, Inc. Internet Businesses • zulily, llc • HSN, Inc. 100,000,000,000 • Woot Inc. • Groupon, Inc. • Barnes & Noble Booksellers, Inc. • Wayfair Inc. (NYSE:W) Internet Businesses • Barnesandnoble.com, Inc. • America's Collectibles Network, Inc. reporting revenue • Orbitz Worldwide, Inc. • Bluestem Group Inc. (OTCPK:BGRP) 10,000,000,000 • Kmart.Com LLC • Central Purchasing LLC • Travelocity, Inc. • Overstock.com Inc. • The Neiman Marcus Group, LLC • TripAdvisor Inc. • drugstore.com, inc. • Lands' End, Inc. • Vitacost.com, Inc. • 1-800-Flowers.com Inc. 1,000,000,000 • Eastbay Inc. • Shutterfly, Inc. • Musician's Friend Inc. • Mouser Electronics, Inc. • Blair Corporation • OTC Direct, Inc. • CustomInk, LLC • HSNi, LLC 100,000,000 • The Sportsman's Guide, Inc. • EVINE Live Inc. • Peapod LLC • BSCV Department Store, LLC • FTD Group, Inc. • Backcountry.com, LLC • 1-800 CONTACTS, Inc. • LTD Commodities, LLC 10,000,000 • AmeriMark Direct, LLC • Duluth Holdings Inc.

• dELiA*s, Inc. (OTCPK:DLIA.Q) • Etsy, Inc. (NasdaqGS:ETSY) Number ofWeb Monthly Visitors • Current Media Group LLC • Gilt Groupe, Inc. • American Blind and Wallpaper Factory, • Fresh Direct, LLC • BSN Sports, Inc. • U.S. Auto Parts Network, Inc. 1,000,000 • CobornsDelivers, LLC • Fareportal, Inc. • Worldwide Vacation & Travel, Inc. • Drs. Foster & Smith, Inc. • Amazon.com, Inc. • Thirty-One Gifts, LLC • The Priceline Group Inc. (QVC, Inc. • Sierra Trading Post, Inc. 100,000 • Expedia Inc • Starcrest Products of California, Inc. 10 100 1,000 10,000 100,000 1,000,000 • Footlocker.com, Inc. Revenue ($m)

11 More Companies Whose Revenues are Dependent on Being Online 277 US companies have revenues that are 100% dependent on online Internet Software and Services (203): Internet Software and Services (203) • ASG Technologies Group, Inc. • ProQuest LLC • Marketo, Inc. • TechTarget, Inc. (NasdaqGM:TTGT) • Google Inc. • EasyLink Services International Corporation • Envestnet, Inc. (NYSE:ENV) • Alarm.Com Holdings, Inc. (NasdaqGS:ALRM) • Coupa Software Incorporated • IAC Search & Media, Inc. • NorthgateArinso, Inc. • HomeAway, Inc. • LivePerson Inc. (NasdaqGS:LPSN) • Marin Software Incorporated (NYSE:MRIN) • Historic AOL LLC • NaviSite, Inc. • GTT Communications, Inc. (NYSE:GTT) • Extreme Reach, Inc. • ChannelAdvisor Corporation (NYSE:ECOM) • Trulia, Inc. • The Cobalt Group, Inc. • Shutterstock, Inc. (NYSE:SSTK) • EBSCO Information Services, Inc. • SciQuest, Inc. • Cisco WebEx LLC • Webloyalty, Inc. • Rocket Fuel Inc. (NasdaqGS:FUEL) • Twilio, Inc. (NYSE:TWLO) • Yodlee, Inc. • eCollege.com, Inc. • CenturyLink Technology Solutions • Nutanix, Inc. • Benefitfocus, Inc. (NasdaqGM:BNFT) • Ooyala, Inc. • Rackspace US, Inc. • Alphabet Inc. (NasdaqGS:GOOGL) • InComm, Inc. • Cvent, Inc. (NYSE:CVT) • Lanyon Solutions, Inc. • OpenTable, Inc. • Facebook, Inc. (NasdaqGS:FB) • GrubHub Inc. (NYSE:GRUB) • Yodle, Inc. • Beeline.com, Inc. • Playboy Enterprises International, Inc. • eBay Inc. (NasdaqGS:EBAY) • Cornerstone OnDemand, Inc. • New Relic, Inc. (NYSE:NEWR) • Sedgwick Claims Management Services, Inc. • CyberSource Corporation • Yahoo! Inc. (NasdaqGS:YHOO) (NasdaqGS:CSOD) • Bazaarvoice, Inc. (NasdaqGS:BV) • Charles River Systems, Inc. • Network Solutions, LLC • MSN • Bankrate, Inc. (NYSE:RATE) • Turning Technologies, LLC • Instructure, Inc. (NYSE:INST) • OCLC Online Computer Library Center, Inc. • LinkedIn Corporation (NYSE:LNKD) • comScore, Inc. (NasdaqGS:SCOR) • INRIX, Inc. • ZocDoc, Inc. • LendingTree, LLC • IAC/InterActiveCorp (NasdaqGS:IAC) • Constant Contact, Inc. • YourPeople, Inc. • Dotster, Inc. • LegalZoom.com, Inc. • Twitter, Inc. (NYSE:TWTR) • 1&1 Internet Inc. • Allconnect, Inc. • AppFolio, Inc. (NasdaqGM:APPF) • Salary.com, Inc. • Akamai Technologies, Inc. (NasdaqGS:AKAM) • Research Now Group, Inc. • Appirio Inc. • Hobsons, Inc. • Digital River Inc. • Rackspace Hosting, Inc. (NYSE:RAX) • Box, Inc. (NYSE:BOX) • 2U, Inc. (NasdaqGS:TWOU) • PubMatic, Inc. • Travelport Limited • GoDaddy Inc. (NYSE:GDDY) • ReachLocal, Inc. • SPS Commerce, Inc. (NasdaqGS:SPSC) • St. Louis Post-Dispatch, LLC • Dealertrack Technologies, Inc. • Pandora Media, Inc. (NYSE:P) • Angie's List, Inc. (NasdaqGS:ANGI) • SoftLayer Technologies, Inc. • CAMP Systems Inc. • Genesys Telecommunications Laboratories, Inc. • AutoTrader.com, Inc. • MetricStream, Inc. • YuMe, Inc. (NYSE:YUME) • e-gatematrix, llc • Active Network, LLC • Inmar, Inc. • AppNexus Inc. • Cision, Inc. • Amber Road, Inc. (NYSE:AMBR) • Active Network, LLC • VeriSign, Inc. (NasdaqGS:VRSN) • LogMeIn, Inc. (NasdaqGS:LOGM) • Carbonite, Inc. (NasdaqGM:CARB) • eGain Corporation (NasdaqCM:EGAN) • Move, Inc. • EarthLink Holdings Corp. (NasdaqGS:ELNK) • Internap Corporation (NasdaqGS:INAP) • Limelight Networks, Inc. (NasdaqGS:LLNW) • Support.com, Inc. (NasdaqCM:SPRT) • Millennial Media Inc. • Sabre GLBL Inc. • GXS, Inc. • Airbnb, Inc. • OneSource Virtual, Inc. • Netscape Communications Corporation • Mitchell International, Inc. • NIC Inc. (NasdaqGS:EGOV) • Consumer Source Holdings, Inc. • EagleView Technologies, Inc. • Freightquote.com, Inc. • Endurance International Group Holdings, Inc. • Datapipe, Inc. • Hortonworks, Inc. (NasdaqGS:HDP) • Market Track, LLC • Digital Insight Corporation (NasdaqGS:EIGI) • QuinStreet, Inc. (NasdaqGS:QNST) • OPOWER, Inc. • Qualtrics, LLC • Internet Brands, Inc. • Hulu, LLC • Blucora, Inc. (NasdaqGS:BCOR) • Velocity Technology Solutions, Inc. • Inter.Net Global, L.L.C. • TravelClick, Inc. • j2 Global, Inc. (NasdaqGS:JCOM) • Stamps.com Inc. (NasdaqGS:STMP) • Care.com, Inc. (NYSE:CRCM) • xAd, Inc. • Radial • CoStar Group Inc. (NasdaqGS:CSGP) • IntraLinks Holdings, Inc. (NYSE:IL) • XO Group Inc. (NYSE:XOXO) • Vubiquity, Inc. • Workfront, Inc. • Yardi Systems, Inc. • Demandware, Inc. • Five9, Inc. (NasdaqGM:FIVN) • Digital Globe Services Inc. (AIM:DGS) • Verio Inc. • LivingSocial, Inc. • DocuSign, Inc. • Apptio, Inc. (NasdaqGM:APTI) • Citrix Online, LLC • HERE Holding Corporation • Ancestry.com LLC • Zillow, Inc. • Trading Technologies International, Inc. • MuleSoft, Inc. • Saba Software, Inc. • Zillow Group, Inc. (NasdaqGS:ZG) • TrueCar, Inc. (NasdaqGS:TRUE) • Newscycle Solutions, Inc. • Nearpod Inc. • Telogis, Inc. • WebMD Health Corp. (NasdaqGS:WBMD) • Quotient Technology Inc. (NYSE:QUOT) • Triple Point Technology, Inc. • ReserveAmerica Inc. • Dialogic, Inc. • Yelp Inc. (NYSE:YELP) • RetailMeNot, Inc. (NasdaqGS:SALE) • Spredfast, Inc. • OneNeck IT Solutions LLC • Piksel Inc. • LexisNexis Group Inc. • Jet.com, Inc. • MINDBODY, Inc. (NasdaqGM:MB) • Zscaler, Inc. • Cox Automotive, Inc. • Web.com Group, Inc. (NasdaqGS:WEB) • Ruffalo Noel Levitz, LLC. • AppDynamics, Inc. • Bisk Education, Inc. • Vertafore, Inc. • j2 Cloud Services, Inc. • Tradeweb Markets LLC • Fieldglass, Inc. • GXS Worldwide, Inc. • Blue Coat, Inc. • Everyday Health, Inc. (NYSE:EVDY) • RealNetworks Inc. (NasdaqGS:RNWK) • Infogroup Inc. • Premiere Global Services, Inc. • DHI Group, Inc. (NYSE:DHX) • BurrellesLuce, Inc. • E2open, Inc. • Gogo Inc. (NasdaqGS:GOGO) • inContact, Inc. (NasdaqCM:SAAS) • CLEAR Wireless LLC

12 Web Traffic of Companies in Cambridge Enterprise Sample

Monthly Web Traffic #1 . In IT, financial services, and retail, large 1 Google 83 companies have a collective 260 billion 105 Billion 165 visitors a month 247 visitors a month to their websites 329 411 . We estimate that $2.8 Trillion of the 493 575 $10.7 Tr annual revenue from the 6,838 657 739 companies is dependent on online 821 903 activity 985 1067 . This represents 15% of the US economy 1149 #1181 1231 Harmon Stores 1313 harmondiscount.com 1395 601,000 visitors a month 1477 1559

Ranking of company 1641 1723 1805 1887 1969 2051 2133 2215 2297

10,00010K 100K 100,000 1,000,0001M 10,000,00010M 100,000,000100M 1,000,000,0001Bn 10,000,000,00010Bn 100,000,000,000100Bn Visitors a Month 13 Example Company Profile

Kernel Density Map showing global office & client locations for AirBnB. Density of client locations depicted by colour coding

14 Revenue Models from Online Services & Traffic

Third party calculator to help a website developer 1. Advertising calculate the monetization of their online traffic value 2. Fremium Model 3. E-commerce 4. Affiliate Marketing 5. Subscription Model 6. Licensing 7. Selling Data from Users 8. Sponsorship/Donations 9. Build to Sell 10. Mobile and Gaming Revenue Models

https://yourstory.com/2014/03/ultimate-master-list-revenue-models-web-mobile-companies/

15 Key Risks to IT Companies

Technology Threats Environmental . Failure of cloud service provision . Natural hazards impact data centers . Failure of software counterparties . Solar storms take down power grid . Failure of internet infrastructure Social & Humanitarian . Cyber attacks . Loss of trust by consumers Geopolitical Threats . ‘Facebook’ switch-off . Censorship of the Internet . Disruptive competitors . Terrorist attacks on datacenters . Insider threats Financial Threats Governance & Liability . Taxation structures (‘Google Tax’) . Regulatory changes . Financial crisis . Antitrust and anti-monopoly break-up . Gender inequality staff strikes

16 Cyber Jeopardizes the 4th Industrial Revolution 1st Industrial Revolution The Steam Age 1760 to 1830 GDP per capita (2019 value) $1,800 to $3,600

2nd Industrial Revolution The Technology Age 1870 to 1914 GDP per capita (2019 value) $4,800 to $8,000 3rd Industrial Revolution Globalization 1970 to 2008 GDP per capita (2019) 4th Industrial Revolution $17,400 The Digital Age to 2019 to ??? $40,000 GDP per capita $38,200 to ???

17 Solving Cyber Risk

Security Critical Companies Infrastructure

Business Organizations

Software Law Vendors Enforcement

Break the Legal Hacker Business The Infrastructure Model Individual 18